Eun Joo Lee Email & Phone Number

Gilroy, Ca, Us

-Cyber Threat Fusion Center (CTFC) - Working in a 24×7 Security Operations Center (SOC)-Provide Tier 2 level escalation support for incidents and provide understanding with guidance and help identify remediation and mitigation recommendation-Onboard new team member by conducting training, reviewing case work, and coaching and mentoring peer engineers and tier one analysts-Experience with security tools such as Google Chronicle, Splunk, CrowdStrike, FireEye, Netwitness, Twinwave, and ServiceNow-Participate with incident response to assess the risk, impact, and scope of identified security threats, as well as leading the response efforts to include containment, eradication, and recovery-Partner with other teams with detection creation to update signature and tune rules, resolve gaps in advanced threats capabilities that are not detected via traditional security tools-Actively contributes to enhancing automation around redundant operational tasks resulting in increased efficiency-Create, edit, peer review and approve standard operating procedures (SOP) leveraging various security tools and other systems providing telemetry for security operations incident response-Negotiated and created procedure for Purple Team Escalation to cover gaps, improve response times, to ensure conformity with corporate information, security policy, and security operation standards-Onboard new security tool and provide training, create documentation, and ensure provisioning for various teams-Conducted Quality Assurance (QA) review and provided feedback to Analysts and Engineers to ensure accuracy and followed established procedures-Adapt Quality Assurance Analyst, review and assure quality in case work for all three tiers of the CTFC, use it as a teaching tool, explain what was missed and what can be improved upon, provide clear examples and actions to take to better perform and document incident work

-Cyber Threat Fusion Center (CTFC) - Working in a 24×7 Security Operations Center (SOC)-Proactively monitor for cyber security events and anomalies using a variety of tools such as SIEM, EDR, firewalls, proxies, application vulnerability scanners, network flow data, external data sources, and cyber threat intelligence to identify potential compromises-Investigate and triage investigation of cyber related issues by utilizing Endpoint Detection Response (EDR), SOAR tools, and Event Management (SIEM) products-Familiar with SIEM aggregated log data to identify threats and anomalies and risks for developing mitigation strategies -Served as a CTFC representative in escalated Incident Response scenarios where many teams are required to coordinate-Participate in assessment, analysis, and detection of security threats by monitoring network traffic, using various security tools, and improving documentation-Participate in incident response to assess and identify impact, scope and risk, with mitigation and containment efforts, endpoint/network defenses, network-focused forensics, and threat hunting

-Cyber Threat Fusion Center (CTFC) - Working in a 24×7 Security Operations Center (SOC)-Experience with cyber security events, analysis, triage, incident handling, and root-cause identification-Conduct thorough investigative actions based on security events and remediate as by standard operating procedures-Monitor network for cyber security events and anomalies using a variety of information technology application such as Splunk, NetWitness, CybeReason, FireEye, Palo Alto, Symantec Endpoint Protection, Sentinel One, Twinwave and CrowdStrike Falcon-Collaboration with senior partners and various lines of business to remediate threats and risk-Assist with process improvements, updating procedures, utilize playbooks and knowledge resources when responding and or identifying incidents-Created dashboards, alerts, and reports for displaying various cyber security related information-Monitor multiple security alert sources, identify and triage significant security events, determine impact and threat severity, escalate according to established procedures and open trouble tickets using the Case Management System-Conducted in-depth investigations of information security breaches to identify vulnerabilities and evaluate risk

-Ensure that production Layer 7 Application Tier security perimeters are mitigated and remediate vulnerability-Daily monitoring of Qualys SSL Labs URLs, WAF, F5 Load Balancers, and SIEM applications-Communicate, identify, report, and resolve issues with various lines of business-Performed quarterly audits to ensure Max Connection F5 load balancers are within threshold-SSL Decryption onboarding, maintenance, end-of-life (decommission), and provide monthly presentations-Weekly review of DAST reports for F5 and WAF to ensure changes are implemented into production-Participate in and facilitate project meetings-Ensure alerts/alarms, documentation, and governance pages are updated-On-call rotation and special security enhancement operations/projects which included DDoS mitigation

Dallas-Fort Worth, Texas, Us

-Create test cases based on requirements and conduct reviews-Analyze the testability of requirements and estimation-Prioritize and execute functional and regression tests-Report defects and raise an issue when necessary-Participate in project planning meetings

Scottsdale, Arizona, Us

-Monitor various production, staging systems and dashboards to respond in an accurate and timely manner-Identify, research, and resolve level two and level three issues for internal users-Respond to Information Security events related to add/change/deletes and other user privilege changes-Perform administration and maintenance of Active Directory users and groups-Work efficiently utilizing a ticketing system to ensure it is kept current with full disposition details-Tracks, monitors, and coordinates with other IT areas to ensure timely resolution to problems-Provide level one support for internal users for 2-factor token support, iPhone, and MiFi support

-Payment Gateway company by utilizing API integration and harnessing knowledge of risk and threat analysis-Familiar with load balancing and fraud tools to drive internal system monitoring and security protocols-Integrated and tested .NET and PHP shopping cart in proprietary systems and WordPress site-Developed the ticketing support and the help center system, FAQs, and Knowledge Base-Testing fixes and new releases to ensure the problem has been adequately resolved-Assist in API integration with the offshore development, marketing, and sales team for system integration-Ability to manage various projects to meet the business objectives-Ensure adherence to PCI compliance